Microsoft Entra ID - Federated Domain SAML Forgery for Global Admin Escalation

Chaitanya B B@mralien

•updated Jul 20, 2025•12•5•109

Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens